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Any Quantum Key Distribution (QKD) protocol consists first of sequences of measurements 
that produce some correlation between classical data. We show that these correlation data must 
violate some Bell inequality in order to contain distillable secrecy, if not they could be produced by 
quantum measurements performed on a separable state of larger dimension. We introduce a new 
QKD protocol and prove its security against any individual attack by an adversary only limited by 
the no-signaling condition. 
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In 1991 Artur Ekert published his seminal paper Quan- 
tum Cryptography based on Bell's theorem [ij. For the 
first time, it was argued that quantum nonlocality could 
be good for something! It was already known, since 1964, 
that quantum correlations allow one to perform some 
tasks classically impossible, like violating Bell's inequal- 
ity between space-like separated regions 2j. But Ekcrt's 
proposal was the first addressing a useful task and this 
had a huge impact on the development of Quantum In- 
formation Science. Yet, none of today's security proofs 
of Quantum Key Distribution (QKD) make a direct use 
of quantum nonlocality (see however the recent work of 
Ref. ^]). The existing proofs are either based on the 
no-cloning theorem, or on the monogamy (i.e. non share- 
ability) of entanglement. All proofs heavily exploit the 
Hilbert space artillery of quantum physics. 

In the recent years, quantum nonlocality underwent 
yet another important twist. Thanks to the seminal pa- 
per by Popescu and Rohrlich it was realized that 
one can study nonlocality without Hilbert space. Indeed, 
although quantum states violate Bell inequalities, there 
is nothing quantum in the derivation of a Bell inequal- 
ity. The picture is richer when one adds the assump- 
tion of no-signaling, i.e. that the correlations between 
distant partners cannot be used to send information, as 
is the case for quantum correlations. The no-signaling 
principle suffices to severely limit the set of correlations. 
Formally, a correlation is a conditional probability dis- 
tribution P(a, b\x, y), where a and b are Alice and Bob's 
output data, respectively, and x and y are their choices 
of inputs. For instance, x and y could be their choice of 
measurement settings and a and b the obtained results. 
The no-signaling condition implies that the marginals are 
independent of the partner's input: 

Pia\x,y) = Y,Pi'^.b\x,y)^Pia\x). (1) 

b 

For finite alphabets for inputs and outputs, the set of 
all these correlations is convex with a finite number of 
extremal points, hence it is a polytope. This new con- 



ceptual tool allows one for the first time to study quan- 
tum nonlocality from the outside, that is without all the 
Hilbert space machinery. Several recent papers explore 
this new avenue 5, 6, 7, 8, 9]. In particular, it is proven in 
[ii that no-signaling alone implies that nonlocal corre- 
lations arc also monogamous since they cannot be cloned. 

It is thus natural to ask whether, as suggested by Artur 
Ekert, the security of QKD does not rely, ultimately, on 
quantum nonlocality. At first sight this seems unlikely. 
The standard answer runs as follows: if Alice and Bob 
are sufficiently entangled, then the adversary Eve is es- 
sentially factorized out. Despite this standard answer, 
the situation is more subtle: If the Alice-Bob correlation 
is local, it can be reproduced by (classical or quantum) 
variables coming from a source. However, a perfect copy 
of these variables could also be sent to Eve. Then it 
could be that Alice and Bob share a separable states of 
larger dimension! Indeed, the local variables necessarily 
enlarge Alice and Bob's Hilbert space. As an example, 
consider BB84 [l^ , where Alice and Bob choose between 
two different measurements. Their correlation can be re- 
produced by the four-qubit separable state 

PAB = J(|oo)(oou + |ii>(iiU) ® (|oo)(oou + |ii)(iiU). 

(2) 

Here, Alice holds the first and third qubit. Whenever 
she measures in the z (x) basis she is actually measuring 
the first (third) qubit in this basis. The same happens 
for Bob, with the second and fourth qubit. Clearly, their 
measurement results are completely correlated when the 
bases agree and uncorrelated otherwise. However their 
state is separable, so BB84 becomes insecure even in the 
ideal noise-free situation! In summary, all security proofs 
of QKD assume that the legitimate partners, Alice and 
Bob, know the dimensions of the Hilbert space describing 
their quantum systems. In practice, this is usually a rea- 
sonable assumption, however it underlines that assump- 
tions are necessary for any security proof. Moreover it is 
conceptually interesting to disentangle the consequences 
of no-signaling from those relying on the Hilbert space 
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formalism. Experimentally, additional Hilbert-space di- 
mensions correspond to "side-channels" , i.e. to degrees of 
freedom coded accidentally. For example, in photon po- 
larization coding, the wavelength could be accidentally 
correlated to the state of polarization. 

In this letter, we first present a new 4-state QKD proto- 
col, next demonstrate its security against any individual 
attack by any adversary only limited by the no-signaling 
condition 3j. In particular. Eve could be supra- quantum^ 
since there are nonsignaling correlations not achievable 
using quantum states 4] . In the new protocol, Alice and 
Bob have for each realization the choice between two 
measurements with binary outcomes. Essential is that 
their measured data violate the Clauser-Horne-Shimony- 
Holt (CHSH) Bell inequahty [uj: 

P(ao - 60) + P{ao - foi) + - ^o) + P{ai ^ 61) < 3, 

(3) 

where P{aj — bk) = P{a = b = Q\x = j,y = k) + P{a = 
b = l\x = j,y = k). For example, Alice and Bob 
could share a Werner state, pw = WP^+ + (1 — 14^) 1/4, 
with visibility W, where P^+ denotes the projector onto 
10+) — (|00) + |ll))/\/2, and perform the measurements 
that maximize the violation of the CHSH-Bell inequal- 
ity 0. But any other way to obtain data violating Q 
is equally good. Hence we name our new protocol the 
CHSH-protocol. Violation of (0) implies that in three 
out of the four measurement choices, Alice and Bob are 
correlated (the three first terms in Q), though not nec- 
essarily maximally, while in the fourth case they are anti- 
correlated. The analog of basis reconciliation goes as fol- 
lows: Bob announces all his measurement settings, Alice 
keeps all her data, but for the case of anti-correlation, 
she flips her bit. Compared to BB84, the partners keep 
all data, however, all data are noisy. For W > I/V2 the 
new protocol produces data that violate Bell's inequality. 
Hence there are no local variables that Eve could hold. 

In the sequence, we limit our analysis to isotropic raw 
correlations with visibility V: 

P{a, b\x, y) = v]^5{a + b = x ■ y) + {\ - V)-^ (4) 

where 5{r = s) = 1 whenever the equality holds modulo 
2, and overwise. For V < l/V^, such correlations can 
be distributed by quantum physics (e.g. by a Werner 
state with W = V2V) and for V > 1/2 they violate 
the Bell inequality Q. This does not imply any loss of 
generality: Alice and Bob can map any binary correlation 
into these isotropic correlations by local operations and 
classical communication keeping the Bell violation 9] . 

Let us study the security of this protocol. As usual, it 
is assumed that the distribution of the correlation is done 
by Eve. Any attack consists of a three-party distribution 




FIG. 1: Pictorial representation of nonsignaling correlations 
P{a, b\x, y) for binary inputs and outputs. The thick lines 
define one of the facets of the polytope of local models, or lo- 
cal polytope, corresponding to the CHSH inequality. All the 
extreme points lying on this facet are also extreme points of 
the more general polytope of nonsignaling correlations. Only 
one extremal point is on top of the CHSH facet, given by 
the nonlocal machine. The curved line schematically repre- 
sents the region of points achievable using quantum states. 
Isotropic correlations Q lie along the vertical line starting 
from the nonlocal machine and entering the local polytope 
through the center of the CHSH facet. In the optimal eaves- 
dropping attack. Eve simulates Alice and Bob's correlation, 
square point, by the proper combination of extreme points of 
the general polytope, circles in the figure. 

P(a, b, e\x, y, z) whose marginal is Q): 

P{a,b\x,y) = ^P{a,b,e\x,y,z) 

e 

= Y,P(e\z)P{a,b\x,y,z,e). (5) 

e 

where for the second equality we used the no-signaling 
condition: Eve's output e is independent of Alice and 
Bob's inputs x and y. We can restrict our considera- 
tions to attacks where Eve prepares extreme points of 
Alice and Bob's no-signaling polytope. Indeed, consider 
an attack where this is not the case, that is, some of the 
terms appearing in Eq. JSJ do not correspond to an ex- 
treme point of Alice-Bob's no-signaling polytope. Then, 
these terms can be expressed as a convex combination of 
extreme points 

P(a, b\x, y, z, e) = ^ Pext(a, b\x, y, z, e, A)P(A). (6) 

A 

Giving the knowledge of A to Eve, one has an attack 
consisting of extreme points and that is at least as good 
as the previous one, since, c.f. ©, 

P{a, b\x, y) = P{e, A|z)Pext(a, ^l^^, V, z, e. A). (7) 

e,A 

We need to recall now some facts about nonsignaling cor- 
relations with binary input and output. Barrett and co- 
workers proved that in this simple binary case, the num- 
ber of extremal nonsignaling correlations is very limited 
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. If moreover one concentrates on the correlations that 
violate the CHSH-Bell inequality, then one finds a unique 
extremal correlation that violates it; this is the isotropic 
correlation with V = 1. This correlation appears in 
the literature as PR-box (5|, or NonLocal Machine (2| or 
Unit of Nonlocality 0- Moreover, there are 8 extremal 
correlations that saturate the inequality see Fig. ^ 
For the local points, all the outcomes are determinis- 
tic and known by Eve. However, if Alice and Bob share 
a nonlocal machine, they have the guarantee of perfect 
monogamy [sj, so Eve cannot be correlated at all. Eve's 
optimal attack then consists of the combination of ex- 
treme points that mimics Alice-Bob's correlation with 
the minimal weight for nonlocal points. Therefore, she 
prepares only those local points that are closer to Alice 
and Bob's correlation. This can be easily understood in 
Figure n in order to reproduce the quantum correlation 
observed by Alice and Bob, represented by a square. Eve 
should send an equal mixture of the eight local points ly- 
ing on the facet, plus the nonlocal machine on top of it. 
In what follows patl denotes the probability that Eve pre- 
pares a nonlocal machine. The Bell violation observed by 
Alice and Bob fixes the value oipNL, since pnl = 2V—1. 
When the observed data are local. Eve can mimic them 
with deterministic local points. However, when the cor- 
relation is nonlocal. Eve is sometimes forced to send a 
nonlocal machine, where she cannot be correlated be- 
cause of the no-signaling principle. The resulting prob- 
ability distribution, after basis reconciliation, is summa- 
rized in Tabled where pl = 1 — Pnl- Eve's informa- 
tion on Alice and Bob's outcomes is represented by two 
variables (ea,eb). The value at each position of the ta- 
ble gives the probability for the corresponding outcomes, 
e.g. P{a = 0,6 = 0,e = (?,0)) = pl/S. Notice that 
since only Bob announces his measurement. Eve some- 
times has deterministic information on Bob's but not on 
Alice's symbol after the basis reconciliation, even if her 
preparation was local. For example, consider the instance 
when Bob announces y = 1, then, even when Eve knows 
ao and ai, she might not know Alice's output. Moreover, 
one can see that, due to the properties of the local points 
lying on the CHSH facet. Eve has full information on 
both outcomes only when a = b. 

Once the optimal individual attack has been deter- 
mined, it is time to study the secrecy properties of the 
resulting probability distribution. One can see that: (i) a 
secure key can already be established with one-way com- 
munication protocols and quantum states, (ii) this proba- 
bility distribution contains secret correlations if and only 
if the CHSH inequality is violated, i.e. pnl > 0, and 
(iii) it seems challenging to reach the Bell violation limit, 
Pnl = 0, by means of the known two-way advantage 
distillation techniques. The detailed calculation of these 
results will be given in a forthcoming paper |l2l| . 

In the case of one-way distillation protocols, it is clear 
that the flow of information has to go from Alice to Bob. 



b 





1 


a (e) 








(0,0) pl/4 







(?,0) Pl/8 


(?,0) pl/8 




(?,?) Pnl/2 








(1,1) Pl/4 


1 


(?,1) Pl/8 


(?,1) pl/8 






(?,?) Pnl/2 



TABLE L Eve's optimal individual attack. Alice and Bob's 
variables are binary, while Eve's information can be repre- 
sented by two ternary variables, ea,eb ~ 0,1, ?. The value 
'?' denotes those cases where she has no information. For 
example, (?,0) means that Eve knows 6 = but not a. 

Indeed, since Bob announces the basis. Eve's information 
on his outcome is larger. From Table^one has that Bob's 
error probability is Eb — Pl/4:, while I{A : E) = Pl/'^- 
Then, the one-way key rate, , satisfies J^j 

> I{A ■.B)-I{A:E) = l- h{pL/i) - ^, (8) 

where h is the binary entropy. This quantity is positive 
for pAri> 0.318. The quantum region is given by p^vL < 
•\/2 — 1 — 0.414, so quantum correlations suffice to achieve 
security against individual nonsignaling attacks. 

Next, one can prove that the obtained probability dis- 
tribution contains secret correlations if and only if there 
is a Bell inequality violation. We take as a measure 
of secret correlations the so-called intrinsic information, 
I{A : B I E) 01 more briefly Ii, introduced in Ti^. A 
tripartite probability distribution can be established by 
public communication if and only if the intrinsic informa- 
tion is zero . It was shown in that if none of the 
parties announces the choice of bases, the set of local and 
public correlations are equivalent, under the no-signaling 
principle. Here, Bob announces his basis through the 
public channel, so it could happen that the honest par- 
ties loose some secrecy. One can see however, that the 
intrinsic information still remains positive for the whole 
region of Bell violation, since 

T hf1 /0^ ^+PNL , fl-PNL\ 

Il = H^-PNL 2) h[— . (9) 

4 V 1 + PNL J 

In order to get this result, we numerically compute /| for 
different values of pnl- In all the cases, we found a per- 
fect agreement with this formula. Interestingly, if Alice 
announces her basis too, Ii — when pnl < 1/5 , ,12. |. 

We also analyze the use of the two-way advantage dis- 
tillation protocol of Ref. Advantage distillation 
moves the region of positive key rate to pnl > 1/5 (12] . 

The use of pre-processing by the parties, as studied in 
Ref. ^3 1 is useful in all the situations. The correspond- 
ing one-way key rate as a function of the disturbance D 
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FIG. 2: Key rates using one-way communication against 
nonsignaling individual attacks. The dashed line corresponds 
to the situation where no pre-processing is employed, while 
the thick one to the optimal pre-processing. In the inset, the 
key rate against a standard quantum eavesdropper is given, 
compared to BB84 (dashed line). 



in the quantum channel is shown in Figure|21 The distur- 
bance is defined in the standard way, namely D = cor- 
responds to a perfect channel, andpjvL = \/2{l~2D) — l. 
The critical disturbance is D < 6.3%. Note a fundamen- 
tal difference between our security analysis and Ekert's 
protocol: in his scheme, D = guarantees perfect secu- 
rity. This is not the case here, since the eavesdropper is 
only limited by the no-signaling principle. In the case of 
two-way communication, a positive key rate is obtained 
when D < 11.36%, or p^r^ > 0.093, still not sufficient 
to cover the region of Bell violation. Therefore, the bi- 
nary probability distribution of Table ^ when the Bell 
violation is small, either contains bipartite bound infor- 
mation ^3 or is distillable using a new technique. Both 
alternatives appear very interesting. 

Finally, it is also relevant to study the protocol in the 
standard scenario where the eavesdropper is quantum 
and Alice and Bob know their Hilbert spaces. A gen- 
eral security proof is beyond the scope of the present 
work. Here, we study the simple case of collective at- 
tacks, where Alice, Bob and Eve are assumed to share 
copies of the same state. We compare the obtained rates 
with those for the BB84 protocol lo| in Ref. 0|, see 
Fig. 12 The quantum rates for our protocol without pre- 
processing are the same as for BB84 with pre-processing 
given by 7 = sin^(7r/8) 1^. For high disturbances, Alice 
starts adding noise, achieving the same rates and critical 
disturbance as for BB84, namely D = 12.4% 

To summarize, usual security proofs of QKD are based 
on entanglement theory. However, entanglement theory, 
like e.g. entanglement witnesses, assume fixed dimen- 
sions for Alice and Bob's Hilbert spaces. If data do not 
violate any Bell inequality, then they can be produced 



by quantum measurements on a separable state of large 
dimension (the extra dimension allows one to include all 
supplementary local variables). Hence no QKD could be 
achieved without either a violation of some Bell inequal- 
ity, or assumptions about the dimension of the relevant 
Hilbert spaces. In this letter we presented a QKD proto- 
col aimed at producing data that violate the CHSH-Bell 
inequality. We proved its security against the most gen- 
eral individual attack without signaling, independently of 
any assumption about Hilbert spaces. To our knowledge, 
our results represent the first step towards the charac- 
terization of optimal nonsignaling eavesdropping attacks. 
Note also that the same data, i.e., same state preparation 
and measurements, can be secure in the standard quan- 
tum scenario or against no-signalling eavesdroppers: only 
the amount of error correction and privacy amplification 
has to be changed. We would like to conclude with a 
comment on the role played by Bell inequalities in our 
discussion. It is often said that any Bell inequality is 
just an example of an, often non-optimal, entanglement 
witness. However, they are more than this, since they 
are derived without invoking the quantum formalism. As 
shown here, they are witnesses of useful correlations in- 
dependent of the Hilbert space structure. 
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